OP
Product
Opensuse
On CISA KEVExploited in the wildRansomware-linked
1,456
CVEs
45
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 86High 271Medium 142Low 1
Watch
Add Opensuse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-4577 | 7.5 | Oct 15 | The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions Affected: 10.3-11.1 |
| CVE-2008-3188 | 7.5 | Jul 22 | libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks… Affected: 11.0 |
| CVE-2008-0063 | 7.5 | Mar 19 | The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote… Affected: 10.2; 10.3 |
| CVE-2016-1942 | 7.4 | Jan 31 | Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwyg: URI or (2)… Affected: 13.1; 13.2 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 13.1; 13.2 |
| CVE-2015-8614 | 7.3 | Apr 11 | Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote… Affected: 13.1; 13.2 |
| CVE-2014-4608 | 7.3 | Jul 3 | Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow… Affected: 11.4 |
| CVE-2010-4226 | 7.2 | Feb 6 | cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive Affected: 2007.05.10; 2010.07.28 |
| CVE-2016-2150 | 7.1 | Jun 9 | SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261 Affected: 13.2 |
| CVE-2009-3939 | 7.1 | Nov 16 | The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the… Affected: 11.0; 11.1; 11.2 |
| CVE-2010-1437 | 7.0 | May 7 | Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory… Affected: 11.1 |
| CVE-2009-3547 | 7.0 | Nov 4 | Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain… Affected: 11.0; 11.2 |
| CVE-2006-7246 | 6.8 | Jan 27 | NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used Affected: 11.3; 11.4; 12.1 |
| CVE-2016-6172 | 6.8 | Sep 26 | PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large… Affected: 13.2 |
| CVE-2016-1285 | 6.8 | Mar 9 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause… Affected: 11.4; 13.1; 13.2 |
| CVE-2013-2625 | 6.5 | Nov 27 | An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8 Affected: 12.2; 12.3 |
| CVE-2014-8127 | 6.5 | Jun 26 | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in… Affected: 13.1; 13.2 |
| CVE-2016-5321 | 6.5 | Jan 20 | The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image Affected: 13.1 |
| CVE-2016-5317 | 6.5 | Jan 20 | Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a… Affected: 13.1; 13.2 |
| CVE-2016-5316 | 6.5 | Jan 20 | Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image… Affected: 13.1; 13.2 |
| CVE-2016-6905 | 6.5 | Oct 3 | The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted… Affected: 13.2 |
| CVE-2016-2829 | 6.5 | Jun 13 | Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the… Affected: 13.1; 13.2 |
| CVE-2016-2825 | 6.5 | Jun 13 | Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL Affected: 13.1; 13.2 |
| CVE-2016-2822 | 6.5 | Jun 13 | Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu Affected: 13.1; 13.2 |
| CVE-2016-1702 | 6.5 | Jun 5 | The SkRegion::readFromMemory function in core/SkRegion.cpp in Skia, as used in Google Chrome before 51.0.2704.79, does not validate the interval count, which allows remote… Affected: 13.2 |
| CVE-2016-1699 | 6.5 | Jun 5 | WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the… Affected: 13.2 |
| CVE-2016-1698 | 6.5 | Jun 5 | The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which… Affected: 13.2 |
| CVE-2016-1689 | 6.5 | Jun 5 | Heap-based buffer overflow in content/renderer/media/canvas_capture_handler.cc in Google Chrome before 51.0.2704.63 allows remote attackers to cause a denial of service or… Affected: 13.2 |
| CVE-2016-1688 | 6.5 | Jun 5 | The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows… Affected: 13.2 |
| CVE-2016-1687 | 6.5 | Jun 5 | The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain sensitive… Affected: 13.2 |
| CVE-2016-1686 | 6.5 | Jun 5 | The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles… Affected: 13.2 |
| CVE-2016-1685 | 6.5 | Jun 5 | core/fxge/ge/fx_ge_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote attackers to cause a denial of service… Affected: 13.2 |
| CVE-2016-1677 | 6.5 | Jun 5 | uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by… Affected: 13.2 |
| CVE-2016-1665 | 6.5 | May 14 | The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote… Affected: 13.1 |
| CVE-2016-2191 | 6.5 | Apr 13 | The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of… Affected: 13.2 |
| CVE-2016-1956 | 6.5 | Mar 13 | Mozilla Firefox before 45.0 on Linux, when an Intel video driver is used, allows remote attackers to cause a denial of service (memory consumption or stack memory corruption) by… Affected: 13.1; 13.2 |
| CVE-2015-8631 | 6.5 | Feb 13 | Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a… Affected: 13.2 |
| CVE-2016-1938 | 6.5 | Jan 31 | The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which… Affected: 13.1; 13.2 |
| CVE-2016-1933 | 6.5 | Jan 31 | Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remote attackers to cause a denial of service (memory consumption or application… Affected: 13.1; 13.2 |
| CVE-2016-0502 | 6.5 | Jan 21 | Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to… Affected: 13.1; 13.2 |
| CVE-2014-3480 | 6.5 | Jul 9 | The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count… Affected: 11.4 |
| CVE-2014-0207 | 6.5 | Jul 9 | The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a… Affected: 11.4 |
| CVE-2014-1523 | 6.5 | Apr 30 | Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote… Affected: 11.4; 12.3; 13.1 |
| CVE-2012-3489 | 6.5 | Oct 3 | The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote… Affected: 11.4; 12.1; 12.2 |
| CVE-2012-1798 | 6.5 | Jun 5 | The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted… Affected: 11.4; 12.1 |
| CVE-2012-0260 | 6.5 | Jun 5 | The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a… Affected: 11.4; 12.1 |
| CVE-2012-0259 | 6.5 | Jun 5 | The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component… Affected: 11.4; 12.1 |
| CVE-2010-2249 | 6.5 | Jun 30 | Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a… Affected: 11.1; 11.2 |
| CVE-2010-0629 | 6.5 | Apr 7 | Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of… Affected: 11.0; 11.1 |
| CVE-2009-2416 | 6.5 | Aug 11 | Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service… Affected: 10.3 through 11.1 |
The 500 most important CVEs for this product (exploited first, then by severity)